Providers are chosen and assessed against the criteria in the outsourcing policy. Due diligence precedes outsourcing and, for a further agreement with an already assessed provider, is repeated only if a risk based view says so, and promptly redone after significant deficiencies or changes. For critical or important functions it evaluates suitability including skills, infrastructure, financial situation and corporate and regulatory status, and may use certifications to international standards, recognised third party audit reports or internal audit reports as support.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.